Preventing surreptitious access to file data by malware

1. A method of preventing unauthorized access to data files, performed at a computing device having one or more processors and memory storing one or more programs configured for execution by the one or more processors, the method comprising:

installing a first application at the computing device, the first application designated as writing to user files, wherein installing the first application comprises:

storing application data files for the first application within a first portion of the memory, wherein files stored in the first portion are designated as read-only for the first application; and

allocating a second portion of the memory for user data files to be used by the first application; and

installing a second application at the computing device, the second application designated as writing to application data files, wherein installing the second application comprises:

allocating a third portion of the memory for prototype writable application data files; and

allocating a fourth portion of the memory for network-based data access.

2. The method of claim 1 , further comprising:

linking the first application to a first system library for managing user files; and

linking the second application to a second system library for managing application data files.

3. The method of claim 2 , wherein the first application is configured to open user data files using a function in the first system library, and wherein the function returns respective file handles for the user data files.

4. The method of claim 2 , further comprising linking the first and second applications to a third system library for file handling.

5. The method of claim 1 , further comprising:

detecting the second application communicatively coupling to a first domain; and

allocating a fifth portion of the memory for application data files accessible only while the computing device is communicatively coupled to the first domain.

6. The method of claim 5 , further comprising copying one or more files from the third portion to the fifth portion.

7. The method of claim 5 , further comprising:

while the second application is executing, obtaining a request from the second application to perform a file open operation;

in response to the request, determining that the second application is communicatively coupled to the first domain; and

restricting the second application to accessing only the fifth portion of the memory in accordance with the determination.

8. The method of claim 7 , further comprising:

after restricting the second application, determining that the first second application is no longer communicatively coupled to the first domain; and

automatically closing any open files stored in the fifth portion of the memory.

9. The method of claim 1 , further comprising:

receiving a request from the first application to open a user data file; and

in response to the request, presenting a user interface for a user of the computing device, the user interface including a listing of user data files from the second portion of the memory.

10. The method of claim 1 , further comprising allocating a fifth portion of the memory for user transfer of files, the fifth portion of memory accessible via one or more system functions linked to the first application, the second application, and a file manager utility.

11. The method of claim 1 , further comprising allocating an additional portion of the memory for kernel storage, wherein system functions are stored in the kernel storage, and wherein the kernel storage is inaccessible by applications installed on the computing device.

12. The method of claim 1 , further comprising:

installing a shared library at the computing device, the shared library designated as writing to user files; and

restricting access of the shared library to only applications designated as writing to user files.

13. The method of claim 12 , further comprising:

installing a second shared library at the computing device, the second shared library designated as writing to application data files; and

restricting access of the second shared library to only applications designated as writing to application data files.

14. A computing device, comprising:

one or more processors;

memory; and

one or more programs stored in the memory and configured for execution by the one or more processors, the one or more programs comprising instructions for:

installing a first application at the computing device, the first application designated as writing to user files, wherein installing the first application comprises:

storing application data files for the first application within a first portion of the memory, wherein files stored in the first portion are designated as read-only for the first application; and

allocating a second portion of the memory for user data files to be used by the first application; and

installing a second application at the computing device, the second application designated as writing to application data files, wherein installing the second application comprises:

allocating a third portion of the memory for prototype writable application data files; and

allocating a fourth portion of the memory for network-based data access.

15. The computing device of claim 14 , wherein the one or more programs further comprise instructions for:

linking the first application to a first system library for managing user files; and

linking the second application to a second system library for managing application data files.

16. The computing device of claim 14 , wherein the one or more programs further comprise instructions for:

detecting the second application communicatively coupling to a first domain; and

allocating a fifth portion of the memory for application data files accessible only while the computing device is communicatively coupled to the first domain.

17. The computing device of claim 14 , wherein the one or more programs further comprise instructions for:

receiving a request from the first application to open a user data file; and

in response to the request, presenting a user interface for a user of the computing device, the user interface including a listing of user data files from the second portion of the memory.

18. The computing device of claim 14 , wherein the one or more programs further comprise instructions for allocating an additional portion of the memory for kernel storage, wherein system functions are stored in the kernel storage, and wherein the kernel storage is inaccessible by applications installed on the computing device.

19. A non-transitory computer-readable storage medium storing one or more programs configured for execution by a computing device having one or more processors and memory, the one or more programs comprising instructions for:

installing a first application at the computing device, the first application designated as writing to user files, wherein installing the first application comprises:

storing application data files for the first application within a first portion of the memory, wherein files stored in the first portion are designated as read-only for the first application; and

allocating a second portion of the memory for user data files to be used by the first application; and

installing a second application at the computing device, the second application designated as writing to application data files, wherein installing the second application comprises:

allocating a third portion of the memory for prototype writable application data files; and

allocating a fourth portion of the memory for network-based data access.

20. The non-transitory computer-readable storage medium of claim 19 , wherein the one or more programs further comprise instructions for:

linking the first application to a first system library for managing user files; and

linking the second application to a second system library for managing application data files.